# kubernetes Dialect

See which types this Dialect interprets and which architectural facts its Rules can establish.

<!-- Generated by scripts/generate-provider-coverage.ts from official Dialect sources. -->

<details>
<summary>Version and compatibility</summary>

**Version:** `0.1.0`.

**Provider bindings and declared compatibility**

- `hashicorp/kubernetes`: `>= 2.0.0, < 3.0.0`.

[All official Dialects](https://docs.rootform.dev/reference/provider-coverage/)

</details>

## Interpreted types

Each row identifies a type and instance kind. Conditional Rules retain their individual conditions in the details below.

| Terraform type | Kind | Classification | Rules |
| --- | --- | --- | --- |
| `kubernetes_daemon_set_v1` | `resource` | [`daemon-set`](#kubernetes-concept-daemon-set) | [`kubernetes-daemon-set`](#rule-kubernetes-daemon-set) |
| `kubernetes_deployment_v1` | `resource` | [`deployment`](#kubernetes-concept-deployment) | [`kubernetes-deployment`](#rule-kubernetes-deployment) |
| `kubernetes_horizontal_pod_autoscaler_v1` | `resource` | [`horizontal-pod-autoscaler`](#kubernetes-concept-horizontal-pod-autoscaler) | [`kubernetes-horizontal-pod-autoscaler`](#rule-kubernetes-horizontal-pod-autoscaler) |
| `kubernetes_ingress_v1` | `resource` | [`ingress`](#kubernetes-concept-ingress) | [`kubernetes-ingress`](#rule-kubernetes-ingress) |
| `kubernetes_namespace_v1` | `resource` | [`namespace`](#kubernetes-concept-namespace) | [`kubernetes-namespace`](#rule-kubernetes-namespace) |
| `kubernetes_network_policy_v1` | `resource` | [`network-policy`](#kubernetes-concept-network-policy) | [`kubernetes-network-policy`](#rule-kubernetes-network-policy) |
| `kubernetes_persistent_volume_claim_v1` | `resource` | [`persistent-volume-claim`](#kubernetes-concept-persistent-volume-claim) | [`kubernetes-persistent-volume-claim`](#rule-kubernetes-persistent-volume-claim) |
| `kubernetes_service_account_v1` | `resource` | [`service-account`](#kubernetes-concept-service-account) | [`kubernetes-service-account`](#rule-kubernetes-service-account) |
| `kubernetes_service_v1` | `resource` | [`service`](#kubernetes-concept-service) | [`kubernetes-service`](#rule-kubernetes-service) |
| `kubernetes_stateful_set_v1` | `resource` | [`stateful-set`](#kubernetes-concept-stateful-set) | [`kubernetes-stateful-set`](#rule-kubernetes-stateful-set) |

## Local vocabulary

### Concepts

<dl>

<div>
<dt id="kubernetes-concept-daemon-set"><code>kubernetes.concept.daemon-set</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/workloads/controllers.rf.hcl#L9-L11">Source</a></dt>
<dd>

A pod scheduler runs on every selected node.

</dd>
<dd>

Used by [`kubernetes-daemon-set`](#rule-kubernetes-daemon-set).

</dd>
</div>

<div>
<dt id="kubernetes-concept-deployment"><code>kubernetes.concept.deployment</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/workloads/controllers.rf.hcl#L1-L3">Source</a></dt>
<dd>

A declaratively managed set of replica pods.

</dd>
<dd>

Used by [`kubernetes-deployment`](#rule-kubernetes-deployment).

</dd>
</div>

<div>
<dt id="kubernetes-concept-horizontal-pod-autoscaler"><code>kubernetes.concept.horizontal-pod-autoscaler</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/autoscaling/horizontal-pod-autoscaler.rf.hcl#L1-L3">Source</a></dt>
<dd>

A controller that scales a workload by observed demand.

</dd>
<dd>

Used by [`kubernetes-horizontal-pod-autoscaler`](#rule-kubernetes-horizontal-pod-autoscaler).

</dd>
</div>

<div>
<dt id="kubernetes-concept-ingress"><code>kubernetes.concept.ingress</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/network/services.rf.hcl#L5-L7">Source</a></dt>
<dd>

HTTP routing into cluster services from outside the cluster.

</dd>
<dd>

Used by [`kubernetes-ingress`](#rule-kubernetes-ingress).

</dd>
</div>

<div>
<dt id="kubernetes-concept-namespace"><code>kubernetes.concept.namespace</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/cluster/namespaces.rf.hcl#L1-L3">Source</a></dt>
<dd>

A namespace partitioning one cluster's workloads, services, and storage.

</dd>
<dd>


<details>
<summary>Used by 10 Rules</summary>

- [`kubernetes-daemon-set`](#rule-kubernetes-daemon-set)
- [`kubernetes-deployment`](#rule-kubernetes-deployment)
- [`kubernetes-horizontal-pod-autoscaler`](#rule-kubernetes-horizontal-pod-autoscaler)
- [`kubernetes-ingress`](#rule-kubernetes-ingress)
- [`kubernetes-namespace`](#rule-kubernetes-namespace)
- [`kubernetes-network-policy`](#rule-kubernetes-network-policy)
- [`kubernetes-persistent-volume-claim`](#rule-kubernetes-persistent-volume-claim)
- [`kubernetes-service`](#rule-kubernetes-service)
- [`kubernetes-service-account`](#rule-kubernetes-service-account)
- [`kubernetes-stateful-set`](#rule-kubernetes-stateful-set)

</details>

</dd>
</div>

<div>
<dt id="kubernetes-concept-network-policy"><code>kubernetes.concept.network-policy</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/network/services.rf.hcl#L9-L11">Source</a></dt>
<dd>

A namespace-scoped policy controlling pod network traffic.

</dd>
<dd>

Used by [`kubernetes-network-policy`](#rule-kubernetes-network-policy).

</dd>
</div>

<div>
<dt id="kubernetes-concept-persistent-volume-claim"><code>kubernetes.concept.persistent-volume-claim</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/storage/persistent-volume-claims.rf.hcl#L1-L3">Source</a></dt>
<dd>

A request for persistent storage bound to a volume.

</dd>
<dd>

Used by [`kubernetes-persistent-volume-claim`](#rule-kubernetes-persistent-volume-claim).

</dd>
</div>

<div>
<dt id="kubernetes-concept-service"><code>kubernetes.concept.service</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/network/services.rf.hcl#L1-L3">Source</a></dt>
<dd>

A stable network endpoint in front of a set of pods.

</dd>
<dd>

Used by [`kubernetes-service`](#rule-kubernetes-service).

</dd>
</div>

<div>
<dt id="kubernetes-concept-service-account"><code>kubernetes.concept.service-account</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/identity-iam/service-accounts.rf.hcl#L1-L3">Source</a></dt>
<dd>

An identity a pod runs under inside the cluster.

</dd>
<dd>

Used by [`kubernetes-deployment`](#rule-kubernetes-deployment), [`kubernetes-service-account`](#rule-kubernetes-service-account), [`kubernetes-stateful-set`](#rule-kubernetes-stateful-set).

</dd>
</div>

<div>
<dt id="kubernetes-concept-stateful-set"><code>kubernetes.concept.stateful-set</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/workloads/controllers.rf.hcl#L5-L7">Source</a></dt>
<dd>

A stateful workload whose pods keep stable identity and storage.

</dd>
<dd>

Used by [`kubernetes-stateful-set`](#rule-kubernetes-stateful-set).

</dd>
</div>

</dl>

### Contexts

<dl>

<div>
<dt id="kubernetes-context-ownership"><code>kubernetes.context.ownership</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/vocabulary.rf.hcl#L1-L3">Source</a></dt>
<dd>

Administrative or lifecycle ownership.

</dd>
<dd>


<details>
<summary>Used by 9 Rules</summary>

- [`kubernetes-daemon-set`](#rule-kubernetes-daemon-set)
- [`kubernetes-deployment`](#rule-kubernetes-deployment)
- [`kubernetes-horizontal-pod-autoscaler`](#rule-kubernetes-horizontal-pod-autoscaler)
- [`kubernetes-ingress`](#rule-kubernetes-ingress)
- [`kubernetes-network-policy`](#rule-kubernetes-network-policy)
- [`kubernetes-persistent-volume-claim`](#rule-kubernetes-persistent-volume-claim)
- [`kubernetes-service`](#rule-kubernetes-service)
- [`kubernetes-service-account`](#rule-kubernetes-service-account)
- [`kubernetes-stateful-set`](#rule-kubernetes-stateful-set)

</details>

</dd>
</div>

</dl>

### Relations

<dl>

<div>
<dt id="kubernetes-relation-runs-as"><code>kubernetes.relation.runs-as</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/workloads/controllers.rf.hcl#L44-L50">Source</a></dt>
<dd>

Introduced by a labeled emission.
Used by [`kubernetes-deployment`](#rule-kubernetes-deployment), [`kubernetes-stateful-set`](#rule-kubernetes-stateful-set).

</dd>
</div>

</dl>

## RF Vocabulary used

- [`rf.concept.kubernetes-cluster`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-concept-kubernetes-cluster)
- [`rf.context.runtime`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-context-runtime)

## Rule details

Open a Rule for its declared behavior and source. [Matching](https://docs.rootform.dev/language/reference/rules/#eligibility-pipeline), [emission resolution](https://docs.rootform.dev/language/reference/emissions/) and [composition](https://docs.rootform.dev/language/reference/composition/) define how evidence can establish it.

<details>
<summary><code>kubernetes.rule.kubernetes-daemon-set</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/workloads/controllers.rf.hcl#L93-L123">Source</a></summary>

<div id="rule-kubernetes-daemon-set"></div>

Matches `resource` instances of `kubernetes_daemon_set_v1`.

**Classification:** [`kubernetes.concept.daemon-set`](#kubernetes-concept-daemon-set).

**Contexts**

- [`rf.context.runtime`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-context-runtime): targets [`rf.concept.kubernetes-cluster`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-concept-kubernetes-cluster) through `provider.host`.
- [`kubernetes.context.ownership`](#kubernetes-context-ownership): targets [`kubernetes.concept.namespace`](#kubernetes-concept-namespace) through `source.metadata[0].namespace`.

<details>
<summary>Conditions, identity and resolution</summary>

**Context through `provider.host`**

- `on_null`: `"indeterminate"`
- `on_empty`: `"indeterminate"`

**Context through `source.metadata[0].namespace`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`
- `external`: `"allow"`
- `match.by`: `target.metadata[0].name`
- `match.strategy`: `"exact"`

</details>

</details>

<details>
<summary><code>kubernetes.rule.kubernetes-deployment</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/workloads/controllers.rf.hcl#L13-L51">Source</a></summary>

<div id="rule-kubernetes-deployment"></div>

Matches `resource` instances of `kubernetes_deployment_v1`.

**Classification:** [`kubernetes.concept.deployment`](#kubernetes-concept-deployment).

**Contexts**

- [`rf.context.runtime`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-context-runtime): targets [`rf.concept.kubernetes-cluster`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-concept-kubernetes-cluster) through `provider.host`.
- [`kubernetes.context.ownership`](#kubernetes-context-ownership): targets [`kubernetes.concept.namespace`](#kubernetes-concept-namespace) through `source.metadata[0].namespace`.

**Relations**

- [`kubernetes.relation.runs-as`](#kubernetes-relation-runs-as): targets [`kubernetes.concept.service-account`](#kubernetes-concept-service-account) through `source.spec[0].template[0].spec[0].service_account_name`.

<details>
<summary>Conditions, identity and resolution</summary>

**Context through `provider.host`**

- `on_null`: `"indeterminate"`
- `on_empty`: `"indeterminate"`

**Context through `source.metadata[0].namespace`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`
- `external`: `"allow"`
- `match.by`: `target.metadata[0].name`
- `match.strategy`: `"exact"`

**Relation through `source.spec[0].template[0].spec[0].service_account_name`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`

</details>

</details>

<details>
<summary><code>kubernetes.rule.kubernetes-horizontal-pod-autoscaler</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/autoscaling/horizontal-pod-autoscaler.rf.hcl#L5-L27">Source</a></summary>

<div id="rule-kubernetes-horizontal-pod-autoscaler"></div>

Matches `resource` instances of `kubernetes_horizontal_pod_autoscaler_v1`.

**Classification:** [`kubernetes.concept.horizontal-pod-autoscaler`](#kubernetes-concept-horizontal-pod-autoscaler).

**Contexts**

- [`kubernetes.context.ownership`](#kubernetes-context-ownership): targets [`kubernetes.concept.namespace`](#kubernetes-concept-namespace) through `source.metadata[0].namespace`.

<details>
<summary>Conditions, identity and resolution</summary>

**Context through `source.metadata[0].namespace`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`
- `external`: `"allow"`
- `match.by`: `target.metadata[0].name`
- `match.strategy`: `"exact"`

</details>

</details>

<details>
<summary><code>kubernetes.rule.kubernetes-ingress</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/network/services.rf.hcl#L45-L75">Source</a></summary>

<div id="rule-kubernetes-ingress"></div>

Matches `resource` instances of `kubernetes_ingress_v1`.

**Classification:** [`kubernetes.concept.ingress`](#kubernetes-concept-ingress).

**Contexts**

- [`rf.context.runtime`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-context-runtime): targets [`rf.concept.kubernetes-cluster`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-concept-kubernetes-cluster) through `provider.host`.
- [`kubernetes.context.ownership`](#kubernetes-context-ownership): targets [`kubernetes.concept.namespace`](#kubernetes-concept-namespace) through `source.metadata[0].namespace`.

<details>
<summary>Conditions, identity and resolution</summary>

**Context through `provider.host`**

- `on_null`: `"indeterminate"`
- `on_empty`: `"indeterminate"`

**Context through `source.metadata[0].namespace`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`
- `external`: `"allow"`
- `match.by`: `target.metadata[0].name`
- `match.strategy`: `"exact"`

</details>

</details>

<details>
<summary><code>kubernetes.rule.kubernetes-namespace</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/cluster/namespaces.rf.hcl#L5-L28">Source</a></summary>

<div id="rule-kubernetes-namespace"></div>

Matches `resource` instances of `kubernetes_namespace_v1`.

**Classification:** [`kubernetes.concept.namespace`](#kubernetes-concept-namespace).

**Contexts**

- [`rf.context.runtime`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-context-runtime): targets [`rf.concept.kubernetes-cluster`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-concept-kubernetes-cluster) through `provider.host`.

<details>
<summary>Conditions, identity and resolution</summary>

**Identity**

- `attributes`: `["id", "metadata[0].name"]`
- `scope`: `"provider"`

**Endpoint**

- `attributes`: `["id", "metadata[0].name"]`

**Context through `provider.host`**

- `on_null`: `"indeterminate"`
- `on_empty`: `"indeterminate"`

</details>

</details>

<details>
<summary><code>kubernetes.rule.kubernetes-network-policy</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/network/services.rf.hcl#L77-L107">Source</a></summary>

<div id="rule-kubernetes-network-policy"></div>

Matches `resource` instances of `kubernetes_network_policy_v1`.

**Classification:** [`kubernetes.concept.network-policy`](#kubernetes-concept-network-policy).

**Contexts**

- [`rf.context.runtime`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-context-runtime): targets [`rf.concept.kubernetes-cluster`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-concept-kubernetes-cluster) through `provider.host`.
- [`kubernetes.context.ownership`](#kubernetes-context-ownership): targets [`kubernetes.concept.namespace`](#kubernetes-concept-namespace) through `source.metadata[0].namespace`.

<details>
<summary>Conditions, identity and resolution</summary>

**Context through `provider.host`**

- `on_null`: `"indeterminate"`
- `on_empty`: `"indeterminate"`

**Context through `source.metadata[0].namespace`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`
- `external`: `"allow"`
- `match.by`: `target.metadata[0].name`
- `match.strategy`: `"exact"`

</details>

</details>

<details>
<summary><code>kubernetes.rule.kubernetes-persistent-volume-claim</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/storage/persistent-volume-claims.rf.hcl#L5-L27">Source</a></summary>

<div id="rule-kubernetes-persistent-volume-claim"></div>

Matches `resource` instances of `kubernetes_persistent_volume_claim_v1`.

**Classification:** [`kubernetes.concept.persistent-volume-claim`](#kubernetes-concept-persistent-volume-claim).

**Contexts**

- [`kubernetes.context.ownership`](#kubernetes-context-ownership): targets [`kubernetes.concept.namespace`](#kubernetes-concept-namespace) through `source.metadata[0].namespace`.

<details>
<summary>Conditions, identity and resolution</summary>

**Context through `source.metadata[0].namespace`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`
- `external`: `"allow"`
- `match.by`: `target.metadata[0].name`
- `match.strategy`: `"exact"`

</details>

</details>

<details>
<summary><code>kubernetes.rule.kubernetes-service-account</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/identity-iam/service-accounts.rf.hcl#L5-L44">Source</a></summary>

<div id="rule-kubernetes-service-account"></div>

Matches `resource` instances of `kubernetes_service_account_v1`.

**Classification:** [`kubernetes.concept.service-account`](#kubernetes-concept-service-account).

**Contexts**

- [`rf.context.runtime`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-context-runtime): targets [`rf.concept.kubernetes-cluster`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-concept-kubernetes-cluster) through `provider.host`.
- [`kubernetes.context.ownership`](#kubernetes-context-ownership): targets [`kubernetes.concept.namespace`](#kubernetes-concept-namespace) through `source.metadata[0].namespace`.

<details>
<summary>Conditions, identity and resolution</summary>

**Identity**

- `attributes`: `["id"]`
- `scope`: `"provider"`

**Endpoint**

- `attributes`: `["id", "metadata[0].name"]`

**Context through `provider.host`**

- `on_null`: `"indeterminate"`
- `on_empty`: `"indeterminate"`

**Context through `source.metadata[0].namespace`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`
- `external`: `"allow"`
- `match.by`: `target.metadata[0].name`
- `match.strategy`: `"exact"`

</details>

</details>

<details>
<summary><code>kubernetes.rule.kubernetes-service</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/network/services.rf.hcl#L13-L43">Source</a></summary>

<div id="rule-kubernetes-service"></div>

Matches `resource` instances of `kubernetes_service_v1`.

**Classification:** [`kubernetes.concept.service`](#kubernetes-concept-service).

**Contexts**

- [`rf.context.runtime`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-context-runtime): targets [`rf.concept.kubernetes-cluster`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-concept-kubernetes-cluster) through `provider.host`.
- [`kubernetes.context.ownership`](#kubernetes-context-ownership): targets [`kubernetes.concept.namespace`](#kubernetes-concept-namespace) through `source.metadata[0].namespace`.

<details>
<summary>Conditions, identity and resolution</summary>

**Context through `provider.host`**

- `on_null`: `"indeterminate"`
- `on_empty`: `"indeterminate"`

**Context through `source.metadata[0].namespace`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`
- `external`: `"allow"`
- `match.by`: `target.metadata[0].name`
- `match.strategy`: `"exact"`

</details>

</details>

<details>
<summary><code>kubernetes.rule.kubernetes-stateful-set</code> <a href="https://github.com/rootform-dev/rootform/blob/dev/dialects/kubernetes/workloads/controllers.rf.hcl#L53-L91">Source</a></summary>

<div id="rule-kubernetes-stateful-set"></div>

Matches `resource` instances of `kubernetes_stateful_set_v1`.

**Classification:** [`kubernetes.concept.stateful-set`](#kubernetes-concept-stateful-set).

**Contexts**

- [`rf.context.runtime`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-context-runtime): targets [`rf.concept.kubernetes-cluster`](https://docs.rootform.dev/language/reference/rf-vocabulary/#rf-concept-kubernetes-cluster) through `provider.host`.
- [`kubernetes.context.ownership`](#kubernetes-context-ownership): targets [`kubernetes.concept.namespace`](#kubernetes-concept-namespace) through `source.metadata[0].namespace`.

**Relations**

- [`kubernetes.relation.runs-as`](#kubernetes-relation-runs-as): targets [`kubernetes.concept.service-account`](#kubernetes-concept-service-account) through `source.spec[0].template[0].spec[0].service_account_name`.

<details>
<summary>Conditions, identity and resolution</summary>

**Context through `provider.host`**

- `on_null`: `"indeterminate"`
- `on_empty`: `"indeterminate"`

**Context through `source.metadata[0].namespace`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`
- `external`: `"allow"`
- `match.by`: `target.metadata[0].name`
- `match.strategy`: `"exact"`

**Relation through `source.spec[0].template[0].spec[0].service_account_name`**

- `on_null`: `"absent"`
- `on_empty`: `"absent"`

</details>

</details>